Three containers run on two networks. web must reach api; tools must not.

   frontend                 backend
   web, tools               api

Look up api from tools, which is only on frontend:

docker exec tools nslookup api

Connect web to backend without restarting it, then check that it resolves and reaches api:

docker network connect backend web
docker exec web getent hosts api
docker exec web curl -s api

Clients will use the name catalog for this service. Give api that alias on backend:

docker network disconnect backend api
docker network connect --alias catalog backend api
docker exec web curl -s catalog

Leave tools on frontend only.